Description
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.
This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.
Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Cassandra | 3.0.0 – ≤ 3.0.30, 3.1.0 – ≤ 3.11.17, 4.0.0 – ≤ 4.0.15, 4.1.0 – ≤ 4.1.7, 5.0.0 – ≤ 5.0.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cassandra | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | cassandra | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.cassandra:cassandra-all | >= 5.0-alpha1, < 5.0.3 | 5.0.3 | GHSA-wmcc-9vch-jmx4 |
| Maven | org.apache.cassandra:cassandra-all | >= 4.1-alpha1, < 4.1.8 | 4.1.8 | GHSA-wmcc-9vch-jmx4 |
| Maven | org.apache.cassandra:cassandra-all | >= 4.0-alpha1, < 4.0.16 | 4.0.16 | GHSA-wmcc-9vch-jmx4 |
| Maven | org.apache.cassandra:cassandra-all | >= 3.1, < 3.11.18 | 3.11.18 | GHSA-wmcc-9vch-jmx4 |
| Maven | org.apache.cassandra:cassandra-all | < 3.0.31 | 3.0.31 | GHSA-wmcc-9vch-jmx4 |
Advisories 1
- WID-SEC-2025-0258 Apache Cassandra: Mehrere Schwachstellen. BSI CERT-Bund (WID) · Feb 4, 2025
References
- https://lists.apache.org/thread/jmks4msbgkl65ssg69x728sv1m0hwz3s vendor-advisory